Install nfdump and nfsen netflow tools in Linux

Using nfsen it is possible to view IP traffic statistics on Linux interfaces including the graphs showing data sent and received (see the screenshot to the right) as well as historical information about all data transfers. So after you’ve configured nfsen and nfdump to monitor traffic on certain Linux server or router you’ll be able to answer the following example questions: What IP was downloading data through 48161 last Wednesday? or How many bytes were sent to IP 8.8.8.8 via 53 port from Linux server? These are the only examples so nfdump and nfdumpnetflow tools gives you wide range of capabilities to monitor and analyze traffic on your Linux host.

Netflow is the protocol developed by Cisco to manage data about IP traffic. In a few words using Netflow you can collect data about all IP data send/received on multiple Cisco/Linux/BSD/Juniper hosts and send it to central Netflow collector that will show you the nice graphs and also will allow to have a complete picture of what data was sent/received on those hosts (including destination and source IP, port, bytes transfered, int/out interfaces etc). Nfdump is netflow collector. Nfsen is graphical tools for generating graphs and querying Nfdump for historical traffic reports. In this article you will see how to deploy all this staff in Linux.

Netflow probe is required to collect IP traffic data on Linux host. In general this piece of sofware will sit in background, store every network activity on certain network interface and then send collected data to Netflow collector nfdump. As Netflow probe I prefer fprobe that is totally simple application that just does its job. If you feel that fprobe is not what you need or there are some problems with installing it you can try softflowd that can do the same job.

When finished Netflow collector becomes ready so you can start capturing traffic from Netflow probe. If you don’t need any graphical tools like nfsen described below you can just start collector and save Netflow data in /var/neflow/ directory (THIS STEP IS OPTIONAL):

In order to install nfsen from sources you have to get all its prerequisites, run one of below lines depending on what Linux distro you’re using (1st line is for Fedora, Centos, Redhat while 2nd line is for Ubuntu, Debian, Mint and similar):

In order to continue the installation you should edit file etc/nfsen.conf to specify where to install nfsen, web server’s username (yes, you have to install apache, lighttpd, nginx or any other web server first), its document root directory etc. The major section of that config file is ‘Netflow sources’ that must list all hosts you’ve started Netflow probes at. Here is an example section for monitoring above Linux host:

When finished it’s time to actually install nfsen using installation script:

./install.pl etc/nfsen.conf

In case of successful installation you will be notified with corresponding congratulations message so it would be proper time to start nfsen daemon:

/path/to/nfsen/bin/nfsen start

Now you can open http://localhost/nfsen/nfsen.php at Linux host where nfsen was installed to start using this Netflow tool and see some graphs. Notice that it takes about 5-10 minutes to see first bars at the graphs, if the graphs are still empty you will have to check at least the following:

1. If fprobe is able to communicate to Netwflow collector and can send Netflow data to it (use ‘ps ax | grep fprobe’ and Linux host being monitored and tcpdump tool at Netflow collector).
2. If Netflow collector is started and can receive data from Netflow probe. Use ‘ps ax | grep nfcapd’ and tcpdump at Netflow collector Linux host.

Thank you very much !! You have shared very good information with us. I will also tell about it to my friends also in fact all the people known to me.Thanks for taking the time to post this. I look forward to reading more and checking back often.

Good day! Do you know if they make any plugins to help with SEO? I'm trying to get my blog to rank for some targeted keywords but I'm not seeing very good results. If you know of any please share. Many thanks!

I'd like to thank you for the efforts you've put in penning this website. I really hope to see the same high-grade blog posts by you later on as well. In truth, your creative writing abilities has motivated me to get my own website now ;)| book cheap flight http://www.funtraveldeals.com/book-flights/

Many thanks for the extremely useful article, really solved my problems.Although as it is the first time that I'm using tools like that i have some question and i will be really glad if someone can answer them:

1) Nfsen contains flows and diagrams so i'm almost sure that fproble and nfdump works. Although when i'm going to the folder data/nfsen/profiles-data/live/myrouter/... there are many file like nfcapd.201307201235 and a lot of them are empty (nfdump -r /data/nfsen/profiles-data/live/MYROUTER/2013/07/20/nfcapd.201307201235) so i guess there is something wrong with the command or timeouts. What i can do to fix that?

2) /data/nfsen/profiles-data/live/MYROUTER... is the folder where flows suposed to be saved or there is another folder where nfdump save the flows?

3)until now the files that contains flows have those fields: date flow start, duration, protocol, scr ip : port, dst ip: port, packets, bytes, flows. Although i would like to capture more information that netflow supports like TCP flags. Can someone tell me how to construct my command to capture more info?

Artem is systems engineer for more than 7 years and holds broad experience in Linux, Unix, Cisco systems administration. Feel free to get in touch with Artem Nosulchik via Google Plus, Twitter or Facebook.

Most Read This Week

LinuxScrew Recommends

Who’s behind LinuxScew?

My name is Artem Nosulchik, I'm part time blogger and full-time Linux sysadmin. In 2007 I started LinuxScrew to share my personal notes on anything related to Linux and Open Source on the whole and found this pretty interesting.